openssh/openssh-portable on Hacker News

…(Andre Lucas, who wrote the multi-platform login recording code). You can see the current set here: https://github.com/openssh/openssh-portable/blob/master/.git...

comment by daztucker · 2026-10-10 · in OpenSSH 10.6

…longer supported as the API we depended upon has been removed and no obvious alternative provided. https://github.com/openssh/openssh-portable/commit/d4b4c304a...

comment by brynet · 2026-10-06 · in OpenSSH 10.6

…typing, and even then there's no delay if it can bundle key presses with non-interactive data. See https://github.com/openssh/openssh-portable/blob/088ca00/cli... For a full desktop session, X11 over TCP should be much faster just because…

comment by wahern · 2026-08-03 · in Sharing an X11 Server Across Hosts with FamilyWild

It's very difficult to reason about, for instance compare the OpenSSH sshd sandbox implementations. https://github.com/openssh/openssh-portable/blob/master/sshd... https://github.com/openssh/openssh-portable/blob/master/sand...…

comment by brynet · 2026-03-09 · in FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing

…it is only applied for PTY sessions, which most computer-computer connections wouldn't be using. https://github.com/openssh/openssh-portable/blob/d7950aca8ea...

comment by mkj · 2026-01-22 · in Why does SSH send 100 packets per keystroke?

…auth. There's a CVE for this, CVE-2016-20012, but the OpenSSH maintainers rejected it as by-design, https://github.com/openssh/openssh-portable/pull/270 .

comment by pseudohadamard · 2026-01-05 · in A ssh server that knows who you are. $ ssh whoami.filippo.io

Upstream is either OpenBSD itself or https://github.com/openssh/openssh-portable , not the FreeBSD port. I'm... not sure why nix is pulling the patch from FreeBSD, that's odd.

comment by yjftsjthsd-h · 2025-12-16 · in High Performance SSH/SCP

…(unlike OpenPGP) - due to SSH keys being small the policy file is also small and readable, compare https://github.com/openssh/openssh-portable/blob/master/.git... with equivalent OpenPGP https://gitlab.com/sequoia-pgp/sequoia/-/blob/main/op…

comment by wiktor-k · 2025-04-07 · in 20 years of Git

I wonder how this will affect ssh. OpenSSH recently restricted more characters for valid usernames: https://github.com/openssh/openssh-portable/commit/7ef3787c8...

comment by mmsc · 2024-12-06 · in Debian opens a can of username worms

…[6] https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/p... [7] https://github.com/openssh/openssh-portable/blob/master/sand...

comment by dhx · 2024-09-21 · in CISA boss: Makers of insecure software are the real cyber villains

…to the SCP command until 2020, committed in 2021, so "over a decade" is just factually impossible: https://github.com/openssh/openssh-portable/commit/197e29f1c... This is why you need to know these things, because now you kind of look like…

comment by jacobgkau · 2024-07-23 · in SSH has become our universal (Unix) external access protocol

>As mentioned elsewhere here, is -D sufficient to avoid exploitation, or is -e necessary as well? https://github.com/openssh/openssh-portable/blob/V_9_8_P1/ss... sshd.c handles no_daemon (-D) and log_stderr (-e) independently. log_stderr…

comment by Arnavion · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

…the entire world relies on for secure access is maintained by seemingly just two people [2]. [1] https://github.com/openssh/openssh-portable/commit/752250caa... [2] https://github.com/openssh/openssh-portable/graphs/contribut...

comment by jamilbk · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

Default is 100: https://github.com/openssh/openssh-portable/blob/master/serv...

comment by JackSlateur · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

…source, please restart sshd after installing, otherwise you run the risk of locking yourself out. https://github.com/openssh/openssh-portable/commit/03e3de416... Edit: Already reported at https://gitlab.archlinux.org/archlinux/packaging/pac…

comment by frankjr · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

…code from sshd's SIGALRM handler to sshd's listener process, where it can be handled synchronously: https://github.com/openssh/openssh-portable/commit/81c1099d22b81ebfd20a334ce986c4f753b0db29 Because this fix is part of a large commit…

comment by FiloSottile · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

…sshd will record a penalty of some duration (e.g. 30 seconds) against the client's address. https://github.com/openssh/openssh-portable/commit/81c1099d2... It's not really a reversable patch that gives anything away to attackers: it…

comment by FiloSottile · 2024-07-01 · in RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

https://github.com/openssh/openssh-portable/commit/81c1099d2...

comment by frankjr · 2024-06-07 · in OpenSSH introduces options to penalize undesirable behavior

…[3] https://www.openssh.com/portable.html [4] https://anongit.mindrot.org/openssh.git [5] https://github.com/openssh/openssh-portable [6] https://anongit.mindrot.org/openssh.git/tree/servconf.c?id=0...

comment by mananaysiempre · 2024-06-07 · in OpenSSH introduces options to penalize undesirable behavior

Yes: https://github.com/openssh/openssh-portable/commit/03e3de416...

comment by djmdjm · 2024-05-18 · in OpenBSD – sshd(8) split into multiple binaries

https://github.com/openssh/openssh-portable/commit/08f579231... ?

comment by throw0101c · 2024-05-17 · in OpenBSD – sshd(8) split into multiple binaries

…systems and includes support for OS-native authentication and auditing (e.g. using PAM). * https://github.com/openssh/openssh-portable Perhaps see specifically the "openbsd-compat" directory, otherwise I think the source tree is very close…

comment by throw0101c · 2024-05-17 · in OpenBSD – sshd(8) split into multiple binaries

Default for the last 24 years according to https://github.com/openssh/openssh-portable/blame/385ecb31e1...

comment by contingencies · 2024-05-01 · in New startup sells coffee through SSH

…simple to interface and quite a nice feature in the first place. The free-standing implementation: https://github.com/openssh/openssh-portable/commit/08f579231...

comment by _flux · 2024-05-01 · in Run0, a systemd based alternative to sudo, announced

I have looked in the sshd code at https://github.com/openssh/openssh-portable and I cannot find it forking and re-execing _itself_. It forks and execs other commands, of course, and it forks to handle new connections but does not re-exec…

comment by rsc · 2024-04-13 · in XZ backdoor story – Initial analysis

…low-privilege process. I don't know any details about that. Here's what Google showed me for that: https://github.com/openssh/openssh-portable/blob/master/READ...

comment by asveikau · 2024-03-30 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

No, I'm thinking of SSH certificates. Here is the description of file format, it's nothing like x509 https://github.com/openssh/openssh-portable/blob/master/PROT...

comment by adontz · 2023-12-17 · in SSH3: SSHv2 using HTTP/3 and QUIC

The key layout is described in https://github.com/openssh/openssh-portable/blob/master/PROT... and you can view it pretty easily via cat private_key_here | head -n -1 | tail -n +2 | base64 -d | xxd One I created in 2016 is using aes256-cbc…

comment by upon_drumhead · 2023-12-10 · in SSH keys stolen by stream of malicious PyPI and NPM packages

…it looks like ssh-agent disables core dumps[1], but I don't see similar usage for sshd 1: https://github.com/openssh/openssh-portable/blob/694150ad927...

comment by garblegarble · 2023-09-06 · in Results of technical investigations for Storm-0558 key acquisition

…on the previous one for the PING/PONG messages used to simulate keystrokes and terminal echo: https://github.com/openssh/openssh-portable/commit/dce6d80d2...

comment by djmdjm · 2023-08-30 · in Keystroke timing obfuscation added to ssh(1)

Link to the actual commit: https://github.com/openssh/openssh-portable/commit/7603ba712...

comment by omeid2 · 2023-08-29 · in Keystroke timing obfuscation added to ssh(1)

…through an arbitrary local process which can do anything to forward the data to the remote end. https://github.com/openssh/openssh-portable/pull/431

comment by rwmj · 2023-08-23 · in An excruciatingly detailed guide to SSH (but only the things I find useful)

…popular one having done so. [1] https://developers.yubico.com/WebAuthn/Concepts/Using_WebAut... [2] https://github.com/openssh/openssh-portable/blob/master/PROT...

comment by lxgr · 2023-05-02 · in Funds of every Trust Wallet browser extension could have been stolen

…the code briefly; the client fortunately does seem to remove all keys not provided by the server: https://github.com/openssh/openssh-portable/blob/36c6c3eff5e... It seems like at least a `known_hosts` compromise would be "self-healing"…

comment by lxgr · 2023-03-25 · in We updated our RSA SSH host key

…socket to make signing requests. https://framkant.org/2017/10/strong-authentication-openssh-h... https://github.com/openssh/openssh-portable/blob/12492c0abf1...

comment by mlyle · 2023-03-24 · in We updated our RSA SSH host key

Well, it used to break scp, but then I fixed scp: https://github.com/openssh/openssh-portable/commit/77e05394a...

comment by CamJN · 2022-08-16 · in SSH tips and tricks

…through seccomp[1] (which NB is quite an achievement to get right, contrast with pledge[2]). [1]: https://github.com/openssh/openssh-portable/blob/master/sand... [2]: https://github.com/openssh/openssh-portable/blob/master/sand...…

comment by rollcat · 2022-06-22 · in How I would sell OpenBSD as a salesperson

…x25519 keypair for the x25519 component of sntrup761x25519, but it seems like a bad idea) [1] https://github.com/openssh/openssh-portable/blob/master/kexs...

comment by sz3 · 2022-04-10 · in OpenSSH now uses hybrid post-quantum streamlined NTRU Prime X25519 by default

Hi Greg, that's the first thing I tried to do. Alas they have issues disabled on the github repo; https://github.com/openssh/openssh-portable/issues redirects to /pulls. So I cloned the repo to start looking more closely at the code in a…

comment by pengaru · 2022-04-08 · in OpenSSH 9.0

…were integrated into the poll loop. This is a mess, and I'm pretty sure I already see a bug. [0] https://github.com/openssh/openssh-portable/blob/master/chan... [1] https://github.com/openssh/openssh-portable/blob/master/clie... Edit: I'm…

comment by pengaru · 2022-04-08 · in OpenSSH 9.0

…(also shown in the previous link) which is actually what ProxyJump is doing under-the-hood anyhow. https://github.com/openssh/openssh-portable/blob/d9dbb5d/ssh...

comment by runlevel1 · 2022-01-09 · in SSH Agent Restriction (new in OpenSSH 8.9)

…to have a modern, Wayland-native, no-nonsense terminal emulator when I do break my config :P. ¹ https://github.com/openssh/openssh-portable/commit/f64f8c00d... ² https://www.mankier.com/5/ssh_config#SetEnv

comment by hpfr · 2021-12-15 · in Foot: A fast and minimalistic Wayland terminal emulator

…desktop environment, which I think is the most common use case. FWIW my proposal for fixing it is https://github.com/openssh/openssh-portable/pull/233 but it isn't the most elegant solution either I guess. It doesn't seem to have picked up…

comment by bodyfour · 2021-09-18 · in The pitfalls of using SSH-agent, or how to use an agent safely

▲ 2

CVE-2016-20012 – Publickey Information leak

story by tool4cool · 2021-09-16 · 0 comments

▲ 2

OpenSSH: After years of forewarning, disable RSA/SHA-1

story by raimue · 2021-08-30 · 0 comments

▲ 25

OpenSSH switches to using gender-neutral language

story by thunderbong · 2021-06-25 · 83 comments

…a very good fix. So in my opinion both of the proposed fixes are not sufficient. The proposed fix: https://github.com/openssh/openssh-portable/commit/b3855ff05... This proposed fix means OpenSSH is not secure 'by default' and would require…

comment by Randor · 2021-05-25 · in OpenSSH 8.6 is still vulnerable to CVE-2020-14145 and will not be fixed

▲ 25

OpenSSH 8.6 is still vulnerable to CVE-2020-14145 and will not be fixed

story by ralfw90 · 2021-05-24 · 19 comments

Most init scripts are in that ballpark. See openssh for example (88 lines) https://github.com/openssh/openssh-portable/blob/master/open... And yet, it still tries to use pidfiles (which systemd has a better alternative for), and notes "We…

comment by viraptor · 2021-05-16 · in Systemd: The Good Parts

That code is 12 years old: https://github.com/openssh/openssh-portable/commit/c8802aac2... So maybe the parent post was remembering a time before then.

comment by ec109685 · 2021-03-31 · in EC2 Serial Console